CWE-22 · Path Traversal (page 25)
Page 25 of 99 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6989 | High | 8.1 | 2025-07-26 | The Kallyas theme for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the delete_font() function in all versio… |
CVE-2025-52452 | High | 8.5 | 2025-07-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - dupli… |
CVE-2025-8132 | Medium | 5.4 | 2025-07-25 | A vulnerability was found in yanyutao0402 ChanCMS up to 3.1.2. It has been rated as critical. Affected by this issue is the function delfile of the file app/ex… |
CVE-2025-7640 | High | 8.1 | 2025-07-24 | The hiWeb Export Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.0.0. This is due to missing o… |
CVE-2018-25113 | | 2025-07-23 | An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attacker… | |
CVE-2010-10012 | | 2025-07-23 | A path traversal vulnerability exists in httpdasm version 0.92, a lightweight Windows HTTP server, that allows unauthenticated attackers to read arbitrary file… | |
CVE-2025-54453 | High | 8.8 | 2025-07-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.Th… |
CVE-2025-54450 | High | 7.2 | 2025-07-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.Th… |
CVE-2025-54446 | Critical | 9.8 | 2025-07-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shel… |
CVE-2025-54443 | Critical | 9.8 | 2025-07-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shel… |
CVE-2025-54438 | Critical | 9.8 | 2025-07-23 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics MagicINFO 9 Server allows Upload a Web Shel… |
CVE-2025-8021 | High | 7.5 | 2025-07-23 | All versions of the package files-bucket-server are vulnerable to Directory Traversal where an attacker can traverse the file system and access files outside o… |
CVE-2025-54141 | High | 7.5 | 2025-07-22 | ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py… |
CVE-2025-54140 | High | 7.5 | 2025-07-22 | pyLoad is a free and open-source Download Manager written in pure Python. In version 0.5.0b3.dev89, an authenticated path traversal vulnerability exists in the… |
CVE-2025-51475 | Medium | 5.0 | 2025-07-22 | Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary fi… |
CVE-2025-51481 | Medium | 6.6 | 2025-07-22 | Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supp… |
CVE-2025-51480 | High | 8.8 | 2025-07-22 | Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted… |
CVE-2025-51463 | High | 7.0 | 2025-07-22 | Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file… |
CVE-2025-7645 | High | 8.1 | 2025-07-22 | The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to arbitrary file deletion due to insuf… |
CVE-2025-46120 | Critical | 9.8 | 2025-07-21 | An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where a pa… |
CVE-2025-49656 | High | 7.5 | 2025-07-21 | Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. U… |
CVE-2025-7896 | Medium | 6.3 | 2025-07-20 | A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this vulnerability is the function download_v… |
CVE-2015-10136 | High | 7.5 | 2025-07-19 | The GI-Media Library plugin for WordPress is vulnerable to Directory Traversal in versions before 3.0 via the 'fileid' parameter. This allows unauthenticated a… |
CVE-2015-10134 | High | 7.5 | 2025-07-19 | The Simple Backup plugin for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 2.7.10. via the download_backup_file function… |
CVE-2025-27210 | High | 7.5 | 2025-07-18 | An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. This vulnerability… |
CVE-2025-6233 | Medium | 6.8 | 2025-07-18 | Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments in the bulk import… |
CVE-2025-7643 | Critical | 9.1 | 2025-07-18 | The Attachment Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_actions() function… |
CVE-2025-3740 | High | 8.8 | 2025-07-18 | The School Management System for Wordpress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 93.1.0 via the 'pag… |
CVE-2025-7712 | Critical | 9.1 | 2025-07-17 | The Madara - Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wp_manga_delete_zip() function… |
CVE-2025-34126 | | 2025-07-16 | A path traversal vulnerability exists in RIPS Scanner version 0.54. The vulnerability allows remote attackers to read arbitrary files on the system with the pr… | |
CVE-2025-34120 | | 2025-07-16 | An unauthenticated file download vulnerability exists in LimeSurvey versions from 2.0+ up to and including 2.06+ Build 151014. The application fails to validat… | |
CVE-2025-34118 | | 2025-07-16 | A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticate… | |
CVE-2025-31070 | High | 7.5 | 2025-07-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon l… |
CVE-2025-28955 | High | 7.5 | 2025-07-16 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in FWDesign Easy Video Player Wordpress & WooCommerce fwdevp allow… |
CVE-2025-7359 | High | 8.2 | 2025-07-16 | The Counter live visitors for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wcvisit… |
CVE-2025-53906 | Medium | 4.1 | 2025-07-15 | Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in Vim’s zip.vim plugin can allow overwriting of arbitrary f… |
CVE-2025-53905 | Medium | 4.1 | 2025-07-15 | Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in Vim’s tar.vim plugin can allow overwriting of arbitrary f… |
CVE-2025-49830 | Medium | 6.5 | 2025-07-15 | Conjur provides secrets management and application identity for infrastructure. An authenticated attacker who is able to load policy can use the policy yaml pa… |
CVE-2025-50819 | High | 7.1 | 2025-07-15 | Directory traversal vulnerability in beiyuouo arxiv-daily thru 2025-05-06 (commit fad168770b0e68aef3e5acfa16bb2e7a7765d687) when parsing the the topic.yml file… |
CVE-2025-53622 | Medium | 5.2 | 2025-07-15 | DSpace open source software is a repository application which provides durable access to digital resources. Prior to versions 7.6.4, 8.2, and 9.1, a path trave… |
CVE-2025-34110 | | 2025-07-15 | A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or write arbitrary files… | |
CVE-2025-7360 | Critical | 9.1 | 2025-07-15 | The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file moving due to insu… |
CVE-2025-6265 | High | 7.2 | 2025-07-15 | A path traversal vulnerability in the file_upload-cgi CGI program of Zyxel NWA50AX PRO firmware version 7.10(ACGE.2) and earlier could allow an authenticated a… |
CVE-2025-7628 | Medium | 5.4 | 2025-07-14 | A vulnerability was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. It has been classified as critical. This affects t… |
CVE-2025-7626 | Medium | 4.3 | 2025-07-14 | A vulnerability has been found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd and classified as critical. Affected by this v… |
CVE-2025-7625 | Medium | 4.3 | 2025-07-14 | A vulnerability, which was classified as critical, was found in YiJiuSmile kkFileViewOfficeEdit up to 5fbc57c48e8fe6c1b91e0e7995e2d59615f37abd. Affected is the… |
CVE-2024-26292 | | 2025-07-14 | An authenticated Arbitrary File Deletion vulnerability enables an attacker to delete critical files. This issue affects Avid NEXIS E-series: before 2025.5.1; A… | |
CVE-2025-7575 | Medium | 4.7 | 2025-07-14 | A vulnerability has been found in Zavy86 WikiDocs up to 1.0.77 and classified as critical. Affected by this vulnerability is the function image_drop_upload_aja… |
CVE-2025-7566 | Medium | 4.7 | 2025-07-14 | A vulnerability has been found in jshERP up to 3.5 and classified as critical. This vulnerability affects the function exportExcelByParam of the file /src/main… |
CVE-2025-7488 | Medium | 4.3 | 2025-07-12 | A vulnerability has been found in JoeyBling SpringBoot_MyBatisPlus up to a6a825513bd688f717dbae3a196bc9c9622fea26 and classified as critical. This vulnerabilit… |
CVE-2025-7518 | Medium | 4.9 | 2025-07-12 | The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.1.42 via the get_local_filename() function. This m… |
CVE-2023-39339 | Medium | 4.9 | 2025-07-12 | A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a malic… |
CVE-2025-7452 | Medium | 6.3 | 2025-07-11 | A vulnerability was found in kone-net go-chat up to f9e58d0afa9bbdb31faf25e7739da330692c4c63. It has been declared as critical. This vulnerability affects the… |
CVE-2025-7450 | Medium | 5.4 | 2025-07-11 | A vulnerability was found in letseeqiji gorobbs up to 1.0.8. It has been classified as critical. This affects the function ResetUserAvatar of the file controll… |
CVE-2025-46704 | Medium | 4.3 | 2025-07-11 | A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest() that could allow for a directory traversal attack. This issue requires an… |
CVE-2025-53632 | Critical | 9.1 | 2025-07-10 | Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a zip archive), the path of the file… |
CVE-2025-44177 | High | 8.2 | 2025-07-09 | A directory traversal vulnerability was discovered in White Star Software Protop version 4.4.2-2024-11-27, specifically in the /pt3upd/ endpoint. An unauthenti… |
CVE-2025-4828 | Critical | 9.8 | 2025-07-09 | The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_delete function in all… |
CVE-2025-53513 | High | 8.8 | 2025-07-08 | The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Upload… |
CVE-2025-40738 | High | 8.8 | 2025-07-08 | A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting uploaded… |
CVE-2025-40737 | High | 8.8 | 2025-07-08 | A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected application does not properly validate file paths when extracting uploaded… |
CVE-2025-42970 | Medium | 5.8 | 2025-07-08 | SAPCAR improperly sanitizes the file paths while extracting SAPCAR archives. Due to this, an attacker could craft a malicious SAPCAR archive containing directo… |
CVE-2025-53375 | Medium | 6.5 | 2025-07-07 | Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker… |
CVE-2025-6807 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getDriverTmpPath Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sens… |
CVE-2025-6806 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole decryptFile Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary fil… |
CVE-2025-6805 | Critical | 9.1 | 2025-07-07 | Marvell QConvergeConsole deleteEventLogFile Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arb… |
CVE-2025-6804 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole compressFirmwareDumpFiles Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disc… |
CVE-2025-6803 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole compressDriverFiles Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2025-6801 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole saveNICParamsToFile Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbit… |
CVE-2025-6800 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole restoreESwitchConfig Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose… |
CVE-2025-6799 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose se… |
CVE-2025-6798 | Critical | 9.1 | 2025-07-07 | Marvell QConvergeConsole deleteAppFile Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrar… |
CVE-2025-6797 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose se… |
CVE-2025-6796 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getAppFileBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensi… |
CVE-2025-6795 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getFileUploadSize Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sen… |
CVE-2025-6794 | Critical | 9.8 | 2025-07-07 | Marvell QConvergeConsole saveAsText Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-6793 | Critical | 9.4 | 2025-07-07 | Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability. This vulnerability allows rem… |
CVE-2023-51232 | High | 7.5 | 2025-07-07 | Directory Traversal vulnerability in dagster-webserver Dagster thru 1.5.11 allows remote attackers to obtain sensitive information via crafted request to the /… |
CVE-2025-6210 | Medium | 6.2 | 2025-07-07 | A vulnerability in the ObsidianReader class of the run-llama/llama_index repository, specifically in version 0.12.27, allows for hardlink-based path traversal… |
CVE-2025-3046 | High | 7.5 | 2025-07-07 | A vulnerability in the `ObsidianReader` class of the run-llama/llama_index repository, versions 0.12.23 to 0.12.28, allows for arbitrary file read through symb… |
CVE-2025-7108 | Medium | 5.4 | 2025-07-07 | A vulnerability classified as critical was found in risesoft-y9 Digital-Infrastructure up to 9.6.7. Affected by this vulnerability is the function deleteFile o… |
CVE-2025-7107 | Medium | 5.3 | 2025-07-07 | A vulnerability classified as critical has been found in SimStudioAI sim up to 0.1.17. Affected is the function handleLocalFile of the file apps/sim/app/api/fi… |
CVE-2025-7098 | Medium | 5.6 | 2025-07-06 | A vulnerability, which was classified as critical, was found in Comodo Internet Security Premium 12.3.4.8162. Affected is an unknown function of the component… |
CVE-2025-49303 | Medium | 6.8 | 2025-07-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-el… |
CVE-2025-28980 | High | 7.7 | 2025-07-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in machouinard Aviation Weather from NOAA aviation-weather-from-no… |
CVE-2025-2932 | High | 8.8 | 2025-07-03 | The JKDEVKIT plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'font_upload_handler' function in al… |
CVE-2025-34076 | High | 7.2 | 2025-07-02 | An authenticated local file inclusion vulnerability exists in Microweber CMS versions <= 1.2.11 through misuse of the backup management API. Authenticated user… |
CVE-2025-53358 | Medium | 6.5 | 2025-07-02 | kotaemon is an open-source RAG-based tool for document comprehension. From versions 0.10.6 and prior, in libs/ktem/ktem/index/file/ui.py, the index_fn method a… |
CVE-2025-53110 | | 2025-07-02 | Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025… | |
CVE-2025-4946 | High | 8.1 | 2025-07-02 | The Vikinger theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the vikinger_delete_activity_media_ajax()… |
CVE-2025-27022 | High | 7.5 | 2025-07-02 | A path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP… |
CVE-2025-24330 | Medium | 6.4 | 2025-07-02 | Sending a crafted SOAP "provision" operation message PlanId field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management netwo… |
CVE-2025-24329 | Medium | 6.4 | 2025-07-02 | Sending a crafted SOAP "provision" operation message archive field within the Mobile Network Operator (MNO) internal Radio Access Network (RAN) management netw… |
CVE-2025-5014 | High | 8.8 | 2025-07-02 | The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wp_… |
CVE-2025-37098 | High | 7.5 | 2025-07-01 | A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. |
CVE-2025-34058 | | 2025-07-01 | Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality. Af… | |
CVE-2025-6925 | Medium | 5.3 | 2025-06-30 | A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-6866 | Medium | 4.3 | 2025-06-29 | A vulnerability has been found in code-projects Simple Forum 1.0 and classified as critical. This vulnerability affects unknown code of the file /forum_downloa… |
CVE-2025-6855 | Medium | 5.5 | 2025-06-29 | A vulnerability, which was classified as critical, has been found in chatchat-space Langchain-Chatchat up to 0.3.1. This issue affects some unknown processing… |
CVE-2025-6854 | Medium | 4.3 | 2025-06-29 | A vulnerability classified as problematic was found in chatchat-space Langchain-Chatchat up to 0.3.1. This vulnerability affects unknown code of the file /v1/f… |